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Summary 



Shortly after Hurricane Katrina, the federal government began a pilot test of 
KatrinaHealth.org, an online electronic health record (EHR) system that shared 
prescription drug information for hurricane evacuees with health care professionals . The 
website was available for a 90-day period. To allow health care providers in affected 
areas to care for patients without violating the Health Insurance Portability and 
Accountability Act (HIPAA), Health and Human Services (HHS) Secretary Leavitt 
waived certain provisions of the HIPAA Privacy Rule and issued guidance to clarify 
situations where the HIPAA privacy rule allows information sharing to assist in disaster 
relief efforts and with patient care. 

This report discusses HHS’s waiver of certain provisions of the HIPAA privacy 
rule and guidance issued by HHS with respect to the use and disclosure of protected 
health information under the HIPAA Privacy Rule in response to Hurricane Katrina. It 
also briefly discusses the development of electronic health records (EHRs) and provides 
a brief overview of KatrinaHealth.org. This report will be updated. 



HIPAA Privacy Rule. Congress enacted the Health Insurance Portability and 
Accountability Act of 1996 (HIPAA) 1 to improve portability and continuity of health 
insurance coverage. The HIPAA Privacy Rule, issued by HHS to implement section 264 
of HIPAA (42 U.S.C. § 1320d-2), regulates the use and disclosure of protected health 
information. 2 

On September 4, 2005, Health and Human Services Secretary Leavitt declared a 
federal public health emergency for Louisiana, Alabama, Mississippi, Llorida, and Texas. 3 



1 P.L. 104-191, 1 10 Stat. 1936, 42 U.S.C. §§ 1320d et seq. 

2 Standards for Privacy of Individually Identifiable Health Information, 45 CFR Parts 160 and 
164; [http ://w w w .hhs . go v/ocr/combinedregtext.pdf] . 

3 U.S. Department of Health and Human Services, Hurricane Katrina: HHS Declares Public 
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